What the Act requires when children’s personal data is processed. General legal information only. Check the current Rules for the detailed method and the exemptions.
Who is a child?
The Act defines a child as a person under 18 years of age.
For businesses
- Obtain verifiable consent of a parent or lawful guardian before processing a child’s personal data.
- Do not process data in a way that is likely to cause detrimental effect on the child’s well-being.
- Do not track, monitor behaviour of or target advertising at children, subject to any exemptions in the Rules.
- Design sign-up flows that can verify the adult and record the consent.
Exemptions
The Rules provide for certain classes of data fiduciaries and purposes for which some of these requirements are relaxed, such as certain educational and healthcare settings. Whether one applies to you needs to be checked against the Rules.
For parents
Parents or guardians can exercise a child’s rights on the child’s behalf, and should read consent requests for children’s apps and services carefully.
Related: Data protection (DPDP) · All data protection guides · Send an enquiry
Important disclaimer: This article is general legal information, not legal advice. It does not create a lawyer-client relationship and is not an advertisement or solicitation under Bar Council of India rules. Verify current statutes, rules and judgments before relying on it.
